Description

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an authenticated user holding only the Agent Builder read privilege can supply an identifier already in use by another user in the same space and cause that user's conversation to be replaced and reassigned to the requesting account. The original owner permanently loses access to the conversation and its history. The impact is limited to loss of integrity and availability of the affected conversation; the attacker does not read the overwritten content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:28.733Z",
  "pubdate": "2026-08-13T20:17:28.733Z",
  "executiveSummary": "An insecure direct object reference and broken access control vulnerability exists in the Kibana Agent Builder A2A JSON-RPC API endpoint. The flaw enables an authenticated user to overwrite and hijack existing conversational sessions belonging to other users within the same space.\nThe vulnerability directly impacts the integrity and availability of stored conversation data within Kibana Agent Builder. An attacker can permanently deny access to conversation histories for legitimate owners while forcibly reassigning the session identifiers to their own account.\nExploitation of this vulnerability requires authentication to the affected Kibana instance along with the Agent Builder read privilege. The attacker must possess or guess a target conversation identifier in use by another user to trigger the overwrite condition.\nThe risk implication is focused on unauthorized data destruction and session hijacking. Because the authorization logic fails to differentiate between non-existent resources and resources owned by distinct principals, unauthorized mutation of state occurs without exposing the underlying conversational payload.",
  "technicalDetails": "The root cause of the vulnerability lies in the flawed authorization and resource validation logic within the Kibana Agent Builder A2A JSON-RPC API endpoint. Specifically, the backend mechanism derives the unique identifier of a stored conversation directly from user-supplied input parameters during API requests.\nThe core architectural defect occurs during the ownership verification phase. The validation routine fails to adequately distinguish between a conversation identifier that does not exist in the datastore and a conversation identifier that actively exists but belongs to a different user account within the same spatial boundary.\nAn authenticated attacker holding only the Agent Builder read privilege can exploit this flaw by supplying a target identifier that is already associated with another user's active session. Because the access control check improperly handles the ownership state, the application processes the request as a valid operation on a resource controlled by the requesting user.\nThe attack flow proceeds as follows: First, the authenticated attacker interacts with the A2A JSON-RPC API endpoint. Second, the attacker formulates a request containing a target conversation identifier known or suspected to belong to another user. Third, the backend accepts the supplied identifier without enforcing strict multi-tenant ownership boundaries. Fourth, the existing conversation record is replaced and reassigned to the attacker's account, resulting in the original owner permanently losing access to the conversation and its associated historical logs.\nThe vulnerable component is the conversation management logic within the Agent Builder A2A JSON-RPC API of Kibana. The exploitation vector requires network exposure to the Kibana API, valid authentication credentials, and low-level privileges restricted to the Agent Builder read capability. The post-exploitation impact is strictly restricted to a loss of data integrity and service availability, as the attacker overwrites the target conversation state without gaining read visibility into the pre-existing private content."
}